CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

functions-falcon-api

Call CrowdStrike Falcon platform APIs (detections, alerts, hosts, RTR) from within Foundry function handlers. TRIGGER when user asks to "call Falcon APIs from a function", "use FalconPy in a function", "use gofalcon in a function", or needs to integrate Falcon platform APIs within serverless function code. DO NOT TRIGGER when user wants to expose external third-party APIs to Foundry — use api-integrations instead.

89

1.49x
Quality

88%

Does it follow best practices?

Impact

97%

1.49x

Average score across 3 eval scenarios

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong, high-signal reference: executable code for both SDKs, verified gotchas, and a tested scope table. It is efficient rather than lean (repeated deprecation warnings, long inlined sections) and delegates its full build workflow to a sibling skill, leaving a few validation steps implicit.

Suggestions

State the Detects deprecation once (in the Common API Patterns section where it's actioned) and drop the duplicate blockquote and DEPRECATED box to save tokens.

Move the NGSIEM polling implementation and severity-mapping table into references/advanced-patterns.md, keeping the search-all gotcha and scope requirements inline as a short summary with a link.

Add an explicit end-to-end sequence (scaffold → declare scopes → implement → local test → deploy) with verification checkpoints, even if development-workflow owns the details.

DimensionReasoningScore

Conciseness

The body is dense with non-obvious, verified information (scope table, search-all gotcha, 207 handling) and avoids explaining concepts Claude already knows, but the Detects deprecation warning is repeated three times and the ~100-line NGSIEM polling implementation could be trimmed or offloaded — minor instances that could be trimmed, not the padding that would drop it to 3.

4 / 5

Actionability

Fully executable, copy-paste-ready code for Python and Go handlers, manifest YAML, test mocks with explicit assertions, and local curl verification commands; the only gap is the "// ... API calls with falconClient ..." placeholder in the Go example, which is minor against comprehensive coverage of common cases.

5 / 5

Workflow Clarity

Suite-ordering guidance, status-code checkpoints in every example, 207/429 error-recovery handling, a local run-and-curl verification loop, and a 3-step scope-resolution procedure give most checkpoints; the overall build sequence is delegated to the development-workflow skill and some validation steps are implicit rather than explicit — fits anchor 4 better than the fully explicit feedback-loop structure of anchor 5.

4 / 5

Progressive Disclosure

The single bundle reference (references/advanced-patterns.md) is real, one level deep, and clearly signaled via a Reference Files table and inline links, with well-organized sections; however, substantial content (the LogScale/NGSIEM section, severity table) is inlined in a ~440-line body that could partly live in reference files — good structure with minor organization gaps rather than anchor 5's clean split.

4 / 5

Total

17

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An exemplary description: concrete capabilities, explicit positive and negative trigger conditions in the user's own phrasing, and clear disambiguation from a sibling skill. The only weakness is that the trigger phrases are all variations of a single intent, leaving a few natural synonyms uncovered.

DimensionReasoningScore

Specificity

"Call CrowdStrike Falcon platform APIs (detections, alerts, hosts, RTR) from within Foundry function handlers" names the domain plus four concrete API areas and both SDKs (FalconPy, gofalcon), matching the comprehensive-coverage anchor rather than the 1-2-action anchor at 3 or the minor-gaps anchor at 4.

5 / 5

Completeness

The first sentence explicitly states what the skill does, and the TRIGGER clause gives concrete when-phrases plus a DO NOT TRIGGER boundary — clearly answers both what and when, matching the anchor-5 example.

5 / 5

Trigger Term Quality

Quoted natural phrasings ("call Falcon APIs from a function", "use FalconPy in a function", "use gofalcon in a function") give good coverage with SDK synonyms, but all three are variants of one root intent and common variations like "CrowdStrike API" or "query Falcon data" are absent — the anchor-4 'good coverage, a few natural terms missing' fits better than comprehensive coverage at 5.

4 / 5

Distinctiveness Conflict Risk

It carves out a clear niche (Falcon platform APIs inside Foundry function handlers) and explicitly disambiguates the nearest sibling skill ("DO NOT TRIGGER when user wants to expose external third-party APIs to Foundry — use api-integrations instead"), minimizing conflict risk.

5 / 5

Total

19

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

14

/

16

Passed

Repository

CrowdStrike/foundry-skills

Path

skills/functions-falcon-api/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.